Data Processing Terms

These terms apply where ActivityRoster processes personal data on behalf of a centre (the “Controller”) — for example the instructor, cert (qualification) and compliance records a centre stores in the platform. They form part of our agreement with each centre and reflect Article 28 UK/EU GDPR.

Roles

The centre is the Controller of its staff/operational data. ActivityRoster is the Processor and processes that data only on the centre's documented instructions (using the platform as intended).

Subject matter & duration

Processing lasts for the term of the subscription plus the post-termination export/retention window. Subject matter: provision of rostering, compliance-tracking and course-administration services.

Nature & purpose

• Storing and displaying instructor records, certs (qualifications), vetting/DBS status, availability, hours and leave.
• Sending service notifications (e.g. shift offers, leave decisions) on the centre's behalf.
• Generating rosters, timesheets and payroll-ready exports.

Types of data & data subjects

Data subjects: the centre's instructors and staff. Data: contact details, employment type, certs (qualifications), compliance/vetting records (which may be special-category or criminal-offence data such as DBS status), working time and leave.

Our obligations

• Process only on the Controller's instructions.
• Keep data confidential and ensure staff are bound by confidentiality.
• Apply appropriate technical and organisational security (encryption in transit, hashed credentials, per-centre isolation, access control, EU data residency).
• Assist the Controller with data-subject requests, breach notification and DPIAs.
• Use sub-processors only under equivalent terms, and tell you of changes.
• On termination, delete or return the data after the export window.

Sub-processors

Current sub-processors: Cloudflare (EU hosting: database, file storage, edge), Stripe (payments), Resend (transactional email), and Sentry (error monitoring with PII scrubbing). A current list is available on request; we'll give notice before adding new ones.

International transfers

Platform data is stored in the EU. Where a sub-processor transfers data outside the UK/EEA, it is covered by an adequacy decision or Standard Contractual Clauses.

Contact

To request a signed DPA or the sub-processor list: privacy@activityroster.com.